Privacy Policy

We Learn French BD is an online French language school based in Dhaka, Bangladesh. This policy covers this website (www.welearnfrenchbd.com): the enrolment and free-class forms, student accounts, quizzes and lessons.

Questions about your data? Email welearnfrenchbd@gmail.com or message us on WhatsApp at 01758599797.

The enrolment form asks for:

• your full name, WhatsApp phone number and email address;
• the course or combo and the batch time you choose;
• how you pay: the full fee or a 50% installment, and the method (bKash, Nagad, or bank / office);
• for bKash, the number you sent the money from and the transaction ID (TrxID).

We also record the amount due, the payment status (pending until our admissions team has checked it), the date, and the language you used the site in. The website never asks for your bKash PIN, a card number or a bank login: you pay in your own bKash or Nagad app or at the bank, and only type the sender number and TrxID here.

We use this to reserve your seat, check your payment and contact you about your classes. If you enrol without signing in and later create an account with the same email address and confirm it, the enrolment is linked to that account so it shows on your dashboard. Paying for a recorded course from your account works the same way: we record the course, the sender number, the TrxID and any note you add.

The free-class form asks for your name, phone number, a WhatsApp number if it is different, your email address and the course you are interested in. We also note the language you used and whether you filled in the page or the pop-up form on a phone. We use this to send you the class time and joining link on WhatsApp, and a confirmation email.

• Email and password. We store your password only as an Argon2 hash, a one-way scrambled form, so nobody at the school can read it.
• Leaked-password check. When you choose a password, we check it against Have I Been Pwned’s list of passwords exposed in data leaks. Only the first five characters of a fingerprint (SHA-1 hash) of the password are sent; the password itself never leaves our server.
• Google sign-in (optional). If you sign in with Google, Google shares your name, email address and profile photo with us, plus an account ID that links your Google login to your account.
• Profile (optional). Your name, phone number, goal, current French level, preferred batch time and a short bio, which you can edit on your dashboard. The school approves new student accounts and emails you when yours is approved.
• Learning records. Your quiz attempts and scores (including written answers, which an instructor may mark), your progress through course lessons, the courses you have access to, and your certificates.
• Sign-in sessions. When you sign in, we store the time, your IP address and your browser type with the session, to keep your account secure.

If you take a quiz without signing in, your answers and result stay in your browser; they reach us only if you sign in to save the result.

When you finish every lesson of a course that offers a certificate, we issue one with a number such as WLF-BD-12345678. Anyone who has that number can open its verification page (/verify/…) and see the name on your profile, the course title, its level and the issue date. That is how others can check a certificate is genuine, so share the number only with people you want to see it. Lookups are limited, so numbers cannot be tried in bulk.

The website sends emails from the school’s own email account, through our hosting provider’s mail server:

• confirmation when you enrol or book a free class;
• payment verified and enrolment confirmed messages;
• account approved;
• email-address confirmation and password-reset links;
• a note when an instructor has marked your written answer.

A copy of each enrolment and free-class registration also goes to the school’s admissions inbox. The website does not send newsletters or advertising emails.

Strictly necessary cookies, always on because signing in cannot work without them:

• Session cookie (__Host-wlf_session): keeps you signed in. It lasts up to 30 days, is renewed while you use the site, and is deleted when you sign out. Scripts on the page cannot read it.
• Two-step login cookie (__Host-wlf_2fa): for accounts with two-step login, it holds your place for 5 minutes between your password and your code.
• Google sign-in cookie (wlf_oauth): lasts 10 minutes while you sign in with Google, to protect that step.

A few things are kept in your browser’s own storage (localStorage and sessionStorage). They stay on your device and are not sent to us:

• your light or dark theme choice;
• a draft of the enrolment form with the details you typed, so a reload or a trip to the bKash app does not lose it; it is deleted when you submit the form or close the tab;
• the progress of a quiz you are taking, and your result until you save it or close the tab;
• the code from an email-confirmation link, while you confirm your address;
• your answer to the cookie banner.

The Meta Pixel is a script from Meta Platforms, the company behind Facebook and Instagram, that helps us see how our Facebook and Instagram ads work. It runs only if you click “Accept” in the cookie banner. Until then, and if you decline, it is not loaded at all.

When it runs, your browser loads Meta’s script, which tells Meta which pages of this site you visit and when you complete a form such as enrolment or a free-class booking (that the form was sent, not what you typed in it). Meta may set its own cookies and connect this with your Facebook or Instagram account; Meta’s own privacy policy covers what Meta does with it.

It never runs on the password-reset and email-confirmation pages, whose addresses contain a private code. You can change your choice at any time with “Cookie settings” at the bottom of every page. If you withdraw your consent, the pixel stops sending from that moment and is not loaded on later visits.

Lesson videos in our recorded courses play in YouTube or Vimeo players embedded in the page. When a lesson with a video opens, your browser connects to YouTube (Google) or Vimeo, and they may collect data under their own privacy policies.

What reaches us is kept in the school’s database and files on the servers of the web-hosting company the school uses (currently Hostinger). Apart from the services named on this page (Google for sign-in, Have I Been Pwned for the password check, Meta for the pixel, YouTube and Vimeo for videos), the website does not send your details to other companies.

School staff with access to the admin portal (admissions and instructors) can see enrolments, payments, free-class registrations, student profiles and learning records, so they can run your classes. Changes staff make there are recorded in an internal log. Certificate details are public as described above.

To stop abuse, the site counts requests per IP address and per email address over short periods (for example, a few form submissions per hour) and turns away anything beyond the limit.

The school has not set fixed deletion dates. We keep your information as long as we need it to provide your classes, and the records the school must keep. You can ask us to delete your data at any time (see below).

Some things expire on their own: a sign-in session ends after 30 days without use, an email-confirmation link stops working after 24 hours, and a password-reset link after 30 minutes.

You can see and edit your profile on your dashboard. To get a copy of the information we hold about you, correct something, or have it deleted, email welearnfrenchbd@gmail.com from the address you used with us, or message us on WhatsApp at 01758599797. We may need to check it is really you before we act.

When the site changes what it collects, we update this page and the date at the top. If a change affects the Meta Pixel, the cookie banner asks for your choice again.